<?xml version="1.0"?>
<ruleset xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" name="WPPluginCheck" xsi:noNamespaceSchemaLocation="https://raw.githubusercontent.com/squizlabs/PHP_CodeSniffer/master/phpcs.xsd">

	<!-- For more information: https://make.wordpress.org/plugins/handbook/review/ -->
	<description>Standards any plugin to be published on wordpress.org should comply with.</description>

	<!-- All SQL queries should be prepared as close to the time of querying the database as possible. -->
	<rule ref="WordPress.DB.PreparedSQL"/>
	<rule ref="WordPress.DB.PreparedSQL.InterpolatedNotPrepared">
		<!-- Ideally this wouldn't trigger on "safe" items, but it's triggered on any variable in the SQL. -->
		<type>warning</type>
	</rule>

	<!-- Verify that placeholders in prepared queries are used correctly. -->
	<rule ref="WordPress.DB.PreparedSQLPlaceholders"/>

	<!-- Nonces. These are triggered on any GET/POST access items. -->
	<rule ref="WordPress.Security.NonceVerification">
		<!-- This is triggered on all GET/POST access, it can't be an error. -->
		<type>warning</type>
	</rule>

	<!-- Sanitized Input rules -->
	<rule ref="WordPress.Security.ValidatedSanitizedInput">
		<type>warning</type>
	</rule>

	<!-- Prohibit the use of the backtick operator. -->
	<rule ref="Generic.PHP.BacktickOperator">
		<severity>7</severity>
	</rule>

	<!-- Prohibit the use of HEREDOC. -->
	<rule ref="PluginCheck.CodeAnalysis.Heredoc">
		<severity>7</severity>
	</rule>

	<!-- Check for short URLs. -->
	<rule ref="PluginCheck.CodeAnalysis.ShortURL">
		<severity>6</severity>
	</rule>

	<!-- Prohibit the use of the `goto` PHP language construct. -->
	<rule ref="Generic.PHP.DiscourageGoto.Found">
		<type>error</type>
		<severity>7</severity>
		<message>The "goto" language construct should not be used.</message>
	</rule>

	<!-- Check for error logs in plugin -->
	<rule ref="WordPress.PHP.DevelopmentFunctions">
		<type>warning</type>
	</rule>

	<!-- No PHP short open tags allowed. -->
	<rule ref="Generic.PHP.DisallowShortOpenTag"/>
	<rule ref="Generic.PHP.DisallowShortOpenTag.Found">
		<severity>7</severity>
	</rule>
	<rule ref="Generic.PHP.DisallowShortOpenTag.EchoFound">
		<severity>7</severity>
	</rule>

	<!-- Alternative PHP open tags not allowed. -->
	<rule ref="Generic.PHP.DisallowAlternativePHPTags">
		<severity>7</severity>
	</rule>

	<!-- Prevent path disclosure when using add_theme_page(). -->
	<rule ref="WordPress.Security.PluginMenuSlug">
		<severity>6</severity>
	</rule>

	<!-- While most plugins shouldn't query the database directly, if they do, it should be done correctly. -->
	<!-- Don't use the PHP database functions and classes, use the WP abstraction layer instead. -->
	<rule ref="WordPress.DB.RestrictedClasses">
		<severity>7</severity>
	</rule>

	<rule ref="WordPress.DB.RestrictedFunctions">
		<severity>7</severity>
	</rule>

	<!-- Check for code WP does better -->
	<rule ref="WordPress.WP.AlternativeFunctions">
		<type>error</type>
		<exclude name="WordPress.WP.AlternativeFunctions.json_encode_json_encode"/>
		<exclude name="WordPress.WP.AlternativeFunctions.file_get_contents_file_get_contents"/>
		<exclude name="WordPress.WP.AlternativeFunctions.file_system_operations_file_put_contents"/>
	</rule>

	<rule ref="Generic.PHP.ForbiddenFunctions">
		<properties>
			<property name="forbiddenFunctions" type="array">
				<element key="move_uploaded_file" value="null"/>
				<element key="passthru" value="null"/>
				<element key="proc_open" value="null"/>
				<element key="create_function" value="null"/>
				<element key="eval" value="null"/>
				<element key="str_rot13" value="null"/>
				<element key="_cleanup_header_comment" value="null"/>
				<element key="_get_plugin_data_markup_translate" value="null"/>
				<element key="_transition_post_status" value="null"/>
				<element key="_wp_post_revision_fields" value="null"/>
				<element key="do_shortcode_tag" value="null"/>
				<element key="get_post_type_labels" value="null"/>
				<element key="wp_get_sidebars_widgets" value="null"/>
				<element key="wp_get_widget_defaults" value="null"/>
			</property>
		</properties>
		<type>error</type>
		<severity>7</severity>
	</rule>

	<rule ref="Squiz.PHP.DiscouragedFunctions">
		<properties>
			<property name="forbiddenFunctions" type="array">
				<element key="set_time_limit" value="null"/>
				<element key="ini_set" value="null"/>
				<element key="ini_alter" value="null"/>
				<element key="dl" value="null"/>
			</property>
		</properties>
	</rule>

	<!-- Check for use of deprecated WordPress classes, functions and function parameters. -->
	<rule ref="WordPress.WP.DeprecatedClasses"/>
	<rule ref="WordPress.WP.DeprecatedFunctions"/>
	<rule ref="WordPress.WP.DeprecatedParameters"/>
	<rule ref="WordPress.DateTime.RestrictedFunctions"/>

	<!-- Check for deprecated WordPress constants. -->
	<rule ref="WordPress.WP.DiscouragedConstants">
		<type>error</type>
		<severity>7</severity>
	</rule>

	<!-- Check for discouraged WordPress functions. -->
	<rule ref="WordPress.WP.DiscouragedFunctions">
		<severity>6</severity>
	</rule>

	<!-- Check for usage of deprecated parameter values in WP functions and provide alternative based on the parameter passed. -->
	<rule ref="WordPress.WP.DeprecatedParameterValues">
		<severity>7</severity>
	</rule>

	<!-- No ByteOrderMark allowed - important to prevent issues with content being sent before headers. -->
	<rule ref="Generic.Files.ByteOrderMark">
		<severity>7</severity>
	</rule>

	<!-- Check for missing required function parameters. -->
	<rule ref="PluginCheck.CodeAnalysis.RequiredFunctionParameters">
		<severity>7</severity>
	</rule>

	<!-- Check for discouraged functions. -->
	<rule ref="PluginCheck.CodeAnalysis.DiscouragedFunctions"/>

</ruleset>